Password-cracking contest results
Are long, noncomplex passwords harder to crack than short, complex passwords? These results lean toward yes
Follow @rogeragrimesOn July 17, 2006, I challenged password-cracking readers to a contest. I was looking to support my conclusion that longer, less complex passwords provided more protection compared with everyday eight- to 10-character shorter, but more complex passwords.
Conventional wisdom says that because end-users have 94 characters to choose from on a 101-key keyboard, breaking an eight-character, complex password -- out of 94^8 = 6,095,689,385,410,816 different possible passwords -- is not a trivial task.
I postulated that an eight-character, complex password was not so difficult to break, and that to withstand normal password cracking, you should increase password length to something beyond 10 characters. I issued a challenge in the form of three Windows NT password hashes:
#1: 0570B4C2CC734E230DE9B67C868FAE04
#2: 7B1FC86A9CD8955963E3930C42F4226F
#3: 4475BCB3B66320BF289D5475C7016A81
The first (and easiest) challenge was a 10-character password with normal complexity -- uppercase and lowercase letters, numbers, and containing two “license-plated” English words. The second, harder challenge was a 15-character password with no complexity -- one or more English words, all lowercase. The third, hardest challenge was a 15-character or longer password with minor complexity -- containing one or more English words. I offered prizes of books, column fame, and $100 for cracking one or more of the challenges.
It’s been several months now, and we have a winner. Well, a winner on the 10-character password-crack challenge. Anthony Adamo of Colorado took about three weeks to reveal the first challenge password of S10wDr1v3r. I sent Tony a copy of all three of my latest books for his efforts. After Tony claimed his prize, two other readers sent in the correct guesses for the 10-character password; one a day after Tony, and another just three weeks ago.
No one has cracked the two larger challenges as of press time, although I know there are several hundred computer teams -- one with over 1,000 computers --working on the challenges.
I did get dozens of bad guesses, and lots of people telling me I’m an idiot or that I’m wrong. If you're in the latter camp, I figure there is no better way to prove me wrong than to send me the plain-text passwords for the 15-character or longer passwords.
I had several writers tell me that my $100 main prize wasn’t enough to motivate them, and if they just had enough monetary motivation they would do it. They said that $1,000 or $10,000 would better motivate them. In every case, I pledged in writing to give them the money they wanted, and still none of them delivered.
And yes, I’ll be keeping the 15-character complex and noncomplex password hashes in a contest for future awards. Good luck.
Does all this conclusively confirm that longer, noncomplex passwords will always win over short, more complex passwords? Of course not, but it adds at least some credibility to my conjecture that increased password length does have its place in boosting password strength.
